documentation_complete: true

title: 'Enable PAM'

description: |-
    UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will
    enable PAM authentication using ChallengeResponseAuthentication and
    PasswordAuthentication in addition to PAM account and session module processing for all
    authentication types.

    To enable PAM authentication, add or correct the following line in
    {{{ sshd_config_file() }}}
    <pre>UsePAM yes</pre>

rationale: |-
    When UsePAM is set to yes, PAM runs through account and session types properly. This is
    important if you want to restrict access to services based off of IP, time or other factors of
    the account. Additionally, you can make sure users inherit certain environment variables
    on login or disallow access to the server.

severity: medium

identifiers:
    cce@rhel8: CCE-86721-8
    cce@rhel9: CCE-86722-6
    cce@rhel10: CCE-87045-1
    cce@sle12: CCE-92203-9
    cce@sle15: CCE-91333-5
    cce@slmicro5: CCE-93883-7

references:
    cis@sle12: 5.2.19
    cis@sle15: 5.2.19
    srg: SRG-OS-000125-GPOS-00065

{{{ complete_ocil_entry_sshd_option(default="no", option="UsePAM", value="yes") }}}

template:
    name: sshd_lineinfile
    vars:
        parameter: UsePAM
        value: 'yes'
        datatype: string

fixtext: |-
    {{{ fixtext_sshd_lineinfile('UsePAM', 'yes') }}}

srg_requirement: '{{{ full_name }}} must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.'
